@de-otio/trellis 0.11.0 → 0.12.1

package/dist/lib/media/promote-decision.js

@@ -0,0 +1,76 @@
+// CONTRACT: stable — coordinate changes. C4 pure functional-core unit.
+//
+// Decide what the moderation worker SHOULD do once both per-track outcomes for
+// a media object are known: combine the tracks into one object-level decision,
+// run that decision through the lifecycle state machine, and report — as plain
+// booleans — which side effects the imperative shell should perform.
+//
+// This function performs NO I/O. It only *reports* intent. The shell applies
+// the reported actions in a fixed, safety-ordered sequence:
+//
+//   1. promote  (publish/adopt the CAS object so bytes can be served)
+//   2. persist  (write the new moderationStatus)
+//   3. emit     (publish the "resolved" moderation event)
+//
+// FAIL-CLOSED is the whole point. An illegal transition (e.g. a replayed
+// decision on an already-terminal APPROVED/REJECTED object) is an idempotent
+// no-op: every action boolean is false, so the shell touches nothing. And
+// `shouldPromote` is true ONLY when the combined decision drove the object to
+// APPROVED *and* the CAS object is actually present — doubt never serves.
+//
+// Pure functional core: no I/O, no clock, no random. Total over its inputs.
+// Lives in the PUBLIC npm tarball: NO thresholds, secrets, or real-category
+// vocabulary here.
+import { combineTrackVerdicts } from "./track-verdict.js";
+import { nextStatus, } from "./moderation-status.js";
+/**
+ * Decide the worker's action for a media object whose tracks have both resolved.
+ *
+ * Logic (total):
+ *  1. `combined = combineTrackVerdicts(visual, audio)` — fail-closed track join.
+ *  2. `transition = nextStatus(currentStatus, { kind: "decision", decision: combined })`.
+ *  3. If `transition.ok === false` (illegal — e.g. replay on a terminal status):
+ *     idempotent NO-OP — `shouldPromote`/`shouldPersistStatus`/`shouldEmitResolved`
+ *     are all `false`.
+ *  4. If `transition.ok === true`:
+ *       - `shouldPersistStatus = true`
+ *       - `shouldEmitResolved  = true`
+ *       - `shouldPromote = transition.status === "APPROVED" && casObjectPresent`
+ *
+ * Safety invariants (property-tested):
+ *  - `shouldPromote === true` ⇒ BOTH tracks were decided-and-approved AND the
+ *    resulting status is APPROVED. Promotion never happens from doubt.
+ *  - APPROVED is never reached unless both tracks are decided-approved.
+ *  - A replay/illegal transition on a terminal status yields an all-false no-op.
+ *  - `casObjectPresent === false` ⇒ `shouldPromote === false`, even at APPROVED.
+ */
+export function decidePromotion(input) {
+    const combined = combineTrackVerdicts(input.visual, input.audio);
+    const transition = nextStatus(input.currentStatus, {
+        kind: "decision",
+        decision: combined,
+    });
+    if (transition.ok === false) {
+        // Illegal transition (e.g. a replayed decision on an already-terminal
+        // APPROVED/REJECTED object). Idempotent no-op: touch nothing.
+        return {
+            combined,
+            transition,
+            shouldPromote: false,
+            shouldPersistStatus: false,
+            shouldEmitResolved: false,
+        };
+    }
+    // Legal transition: we will persist the new status and emit the resolved
+    // event. We only promote (publish bytes) when the object actually became
+    // APPROVED *and* the CAS object exists to serve.
+    const shouldPromote = transition.status === "APPROVED" && input.casObjectPresent;
+    return {
+        combined,
+        transition,
+        shouldPromote,
+        shouldPersistStatus: true,
+        shouldEmitResolved: true,
+    };
+}
+//# sourceMappingURL=promote-decision.js.map

package/dist/lib/media/promote-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote-decision.js","sourceRoot":"","sources":["../../../src/lib/media/promote-decision.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,iDAAiD;AACjD,0DAA0D;AAC1D,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,mBAAmB;AAEnB,OAAO,EAAE,oBAAoB,EAAqB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EACL,UAAU,GAIX,MAAM,wBAAwB,CAAC;AA2ChC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE;QACjD,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC5B,sEAAsE;QACtE,8DAA8D;QAC9D,OAAO;YACL,QAAQ;YACR,UAAU;YACV,aAAa,EAAE,KAAK;YACpB,mBAAmB,EAAE,KAAK;YAC1B,kBAAkB,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,aAAa,GACjB,UAAU,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAE7D,OAAO;QACL,QAAQ;QACR,UAAU;QACV,aAAa;QACb,mBAAmB,EAAE,IAAI;QACzB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC"}

package/dist/lib/media/quota-check.d.ts

@@ -0,0 +1,22 @@
+import type { QuotaState, QuotaLimits } from "./quota-types.js";
+export type QuotaDenialReason = "object-cap" | "byte-cap";
+export interface QuotaCheckResult {
+    allowed: boolean;
+    reason?: QuotaDenialReason;
+}
+/**
+ * Determine whether an incoming upload is permitted under the tenant's quota.
+ *
+ * Decision logic (evaluated in order; FAIL-CLOSED throughout):
+ *   1. If any number argument is NaN or non-finite => denied (no reason tag, caller
+ *      should treat this as a validation failure upstream).
+ *   2. If incomingBytes < 0 => denied (same: malformed input, not a quota case).
+ *   3. If currentObjects >= maxObjects => denied, reason "object-cap".
+ *   4. If currentBytes + incomingBytes > maxBytes => denied, reason "byte-cap".
+ *   5. Otherwise => allowed.
+ *
+ * Limits are ALWAYS supplied as arguments sourced from Env.media — this module
+ * never hard-codes operational parameters.
+ */
+export declare function checkUploadQuota(state: QuotaState, incomingBytes: number, limits: QuotaLimits): QuotaCheckResult;
+//# sourceMappingURL=quota-check.d.ts.map

package/dist/lib/media/quota-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-check.d.ts","sourceRoot":"","sources":["../../../src/lib/media/quota-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,UAAU,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,WAAW,GAClB,gBAAgB,CA+BlB"}

package/dist/lib/media/quota-check.js

@@ -0,0 +1,42 @@
+// Pure functional-core unit — no I/O, no AWS SDK, no network, no Date.now.
+// FAIL-CLOSED: any input that cannot be safely reasoned about yields denied.
+/**
+ * Determine whether an incoming upload is permitted under the tenant's quota.
+ *
+ * Decision logic (evaluated in order; FAIL-CLOSED throughout):
+ *   1. If any number argument is NaN or non-finite => denied (no reason tag, caller
+ *      should treat this as a validation failure upstream).
+ *   2. If incomingBytes < 0 => denied (same: malformed input, not a quota case).
+ *   3. If currentObjects >= maxObjects => denied, reason "object-cap".
+ *   4. If currentBytes + incomingBytes > maxBytes => denied, reason "byte-cap".
+ *   5. Otherwise => allowed.
+ *
+ * Limits are ALWAYS supplied as arguments sourced from Env.media — this module
+ * never hard-codes operational parameters.
+ */
+export function checkUploadQuota(state, incomingBytes, limits) {
+    const { currentObjects, currentBytes } = state;
+    const { maxObjects, maxBytes } = limits;
+    // FAIL-CLOSED: bad numbers => denied. Cover all inputs for completeness.
+    if (!Number.isFinite(currentObjects) ||
+        !Number.isFinite(currentBytes) ||
+        !Number.isFinite(incomingBytes) ||
+        !Number.isFinite(maxObjects) ||
+        !Number.isFinite(maxBytes)) {
+        return { allowed: false };
+    }
+    // FAIL-CLOSED: negative incomingBytes is nonsensical => denied.
+    if (incomingBytes < 0) {
+        return { allowed: false };
+    }
+    // Object cap is checked before byte cap (object cap takes priority in ordering).
+    if (currentObjects >= maxObjects) {
+        return { allowed: false, reason: "object-cap" };
+    }
+    // Byte cap: currentBytes + incomingBytes must be <= maxBytes.
+    if (currentBytes + incomingBytes > maxBytes) {
+        return { allowed: false, reason: "byte-cap" };
+    }
+    return { allowed: true };
+}
+//# sourceMappingURL=quota-check.js.map

package/dist/lib/media/quota-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-check.js","sourceRoot":"","sources":["../../../src/lib/media/quota-check.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,6EAA6E;AAW7E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAiB,EACjB,aAAqB,EACrB,MAAmB;IAEnB,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAExC,yEAAyE;IACzE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,gEAAgE;IAChE,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,iFAAiF;IACjF,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClD,CAAC;IAED,8DAA8D;IAC9D,IAAI,YAAY,GAAG,aAAa,GAAG,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/lib/media/quota-types.d.ts

@@ -0,0 +1,15 @@
+/** A tenant's current measured usage of the media store. */
+export interface QuotaState {
+    /** Number of objects currently counted against the tenant's quota. */
+    readonly currentObjects: number;
+    /** Total bytes currently counted against the tenant's quota. */
+    readonly currentBytes: number;
+}
+/** The tenant's quota ceilings. Injected from Env.media — never literals. */
+export interface QuotaLimits {
+    /** Maximum number of objects the tenant may store. */
+    readonly maxObjects: number;
+    /** Maximum total bytes the tenant may store. */
+    readonly maxBytes: number;
+}
+//# sourceMappingURL=quota-types.d.ts.map

package/dist/lib/media/quota-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-types.d.ts","sourceRoot":"","sources":["../../../src/lib/media/quota-types.ts"],"names":[],"mappings":"AAQA,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/lib/media/quota-types.js

@@ -0,0 +1,9 @@
+// CONTRACT: stable — coordinate changes. Shared P0b quota value types.
+//
+// Pure data contracts shared by the quota-enforcement functional-core unit and
+// the shell that loads/persists tenant usage. NO behavior, NO limits literals
+// here — the LIMITS are operational parameters sourced from Env.media at the
+// call site (a hard-coded cap in this PUBLIC tarball would be a published
+// quota). This file only names the shapes.
+export {};
+//# sourceMappingURL=quota-types.js.map

package/dist/lib/media/quota-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-types.js","sourceRoot":"","sources":["../../../src/lib/media/quota-types.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C"}

package/dist/lib/media/route-upload.d.ts

@@ -0,0 +1,58 @@
+/**
+ * routeUpload — pure functional-core routing decision for an inbound upload.
+ *
+ * Maps a `Content-Type` header value to one of three ingest routes:
+ *
+ * - `sync-image`    — the file is a re-encodable raster image (image/*,
+ *                     matching the P0a `REENCODABLE_IMAGE_TYPES` set); handled
+ *                     synchronously in the upload handler.
+ * - `async-pending` — the file is video/* or audio/*; stored PENDING and
+ *                     handed off to the P0b async worker.
+ * - `reject`        — anything else, including empty, malformed, or unknown
+ *                     types (fail-closed).
+ *
+ * Design invariants:
+ * - Pure and total: no I/O, no exceptions. Returns one of the three union
+ *   members for every input including null/undefined.
+ * - Case-insensitive: "Image/JPEG" and "image/jpeg" both route to sync-image.
+ * - Parameters stripped: "image/jpeg; charset=utf-8" is treated as
+ *   "image/jpeg".
+ * - Fail-closed: uncertainty → reject, never sync-image/async-pending.
+ * - No operational thresholds (no size caps, no rate limits) — those are
+ *   imperative-shell concerns.
+ */
+/**
+ * The three ingest routes for an uploaded object.
+ *
+ * - `sync-image`    — re-encode synchronously; the upload handler completes
+ *                     the full pipeline inline and records the object as APPROVED
+ *                     after the re-encode pass.
+ * - `async-pending` — store as-is, record as PENDING, fan out to the P0b
+ *                     async processing worker.
+ * - `reject`        — refuse the upload at the type-routing boundary (before
+ *                     bytes are read / stored). Caller must return an error.
+ */
+export type IngestRoute = {
+    readonly kind: "sync-image";
+} | {
+    readonly kind: "async-pending";
+} | {
+    readonly kind: "reject";
+};
+/**
+ * Route an inbound upload by its declared Content-Type (MIME type).
+ *
+ * Accepts the raw Content-Type string as sent by the browser/client.
+ * Parameters (`;` and everything after) are stripped before matching so
+ * "image/png; q=0.9" routes identically to "image/png".
+ *
+ * The image set mirrors `REENCODABLE_IMAGE_TYPES` from the P0a
+ * image-normalizer exactly: jpeg/jpg/png/webp/gif. SVG, HEIC/HEIF, TIFF, and
+ * all other image/* sub-types route to reject (fail-closed).
+ *
+ * @param contentType - The raw Content-Type header value. Accepts null/undefined
+ *   (both route to reject).
+ * @returns The routing decision — never throws.
+ */
+export declare function routeUpload(contentType: string): IngestRoute;
+//# sourceMappingURL=route-upload.d.ts.map

package/dist/lib/media/route-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-upload.d.ts","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAOhC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAyC5D"}

package/dist/lib/media/route-upload.js

@@ -0,0 +1,80 @@
+/**
+ * routeUpload — pure functional-core routing decision for an inbound upload.
+ *
+ * Maps a `Content-Type` header value to one of three ingest routes:
+ *
+ * - `sync-image`    — the file is a re-encodable raster image (image/*,
+ *                     matching the P0a `REENCODABLE_IMAGE_TYPES` set); handled
+ *                     synchronously in the upload handler.
+ * - `async-pending` — the file is video/* or audio/*; stored PENDING and
+ *                     handed off to the P0b async worker.
+ * - `reject`        — anything else, including empty, malformed, or unknown
+ *                     types (fail-closed).
+ *
+ * Design invariants:
+ * - Pure and total: no I/O, no exceptions. Returns one of the three union
+ *   members for every input including null/undefined.
+ * - Case-insensitive: "Image/JPEG" and "image/jpeg" both route to sync-image.
+ * - Parameters stripped: "image/jpeg; charset=utf-8" is treated as
+ *   "image/jpeg".
+ * - Fail-closed: uncertainty → reject, never sync-image/async-pending.
+ * - No operational thresholds (no size caps, no rate limits) — those are
+ *   imperative-shell concerns.
+ */
+// Singleton values avoid allocating a new object on every call.
+const SYNC_IMAGE = { kind: "sync-image" };
+const ASYNC_PENDING = { kind: "async-pending" };
+const REJECT = { kind: "reject" };
+/**
+ * Route an inbound upload by its declared Content-Type (MIME type).
+ *
+ * Accepts the raw Content-Type string as sent by the browser/client.
+ * Parameters (`;` and everything after) are stripped before matching so
+ * "image/png; q=0.9" routes identically to "image/png".
+ *
+ * The image set mirrors `REENCODABLE_IMAGE_TYPES` from the P0a
+ * image-normalizer exactly: jpeg/jpg/png/webp/gif. SVG, HEIC/HEIF, TIFF, and
+ * all other image/* sub-types route to reject (fail-closed).
+ *
+ * @param contentType - The raw Content-Type header value. Accepts null/undefined
+ *   (both route to reject).
+ * @returns The routing decision — never throws.
+ */
+export function routeUpload(contentType) {
+    // Guard: null/undefined/empty → reject.
+    if (!contentType || typeof contentType !== "string") {
+        return REJECT;
+    }
+    // Strip parameters ("; charset=utf-8", "; boundary=…", etc.) and normalise
+    // to lowercase for case-insensitive matching.
+    const base = contentType.split(";")[0].trim().toLowerCase();
+    if (!base) {
+        return REJECT;
+    }
+    // --- image/* ---------------------------------------------------------------
+    // Only the re-encodable set (mirrors REENCODABLE_IMAGE_TYPES from
+    // apps/api/src/lib/services/image-normalizer.ts).  Other image/* sub-types
+    // (svg+xml, heic, heif, tiff, bmp, …) are rejected.
+    switch (base) {
+        case "image/jpeg":
+        case "image/jpg": // alias; normalised to image/jpeg downstream
+        case "image/png":
+        case "image/webp":
+        case "image/gif": // static raster in P0a (animated → first frame only)
+            return SYNC_IMAGE;
+    }
+    // --- video/* and audio/* ---------------------------------------------------
+    // Stored PENDING; transcoded and moderated by the P0b async worker.
+    if (base.startsWith("video/") || base.startsWith("audio/")) {
+        // Require a non-empty sub-type: "video/" (bare slash, no sub-type) is
+        // malformed and goes to reject.
+        const subType = base.slice(base.indexOf("/") + 1);
+        if (subType) {
+            return ASYNC_PENDING;
+        }
+        return REJECT;
+    }
+    // Everything else (application/*, text/*, unknown, etc.) → fail-closed.
+    return REJECT;
+}
+//# sourceMappingURL=route-upload.js.map

package/dist/lib/media/route-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-upload.js","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkBH,gEAAgE;AAChE,MAAM,UAAU,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvD,MAAM,aAAa,GAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC7D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,wCAAwC;IACxC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,kEAAkE;IAClE,2EAA2E;IAC3E,oDAAoD;IACpD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,6CAA6C;QAC/D,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,EAAE,qDAAqD;YACrE,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/media/serve-gate.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Fail-closed serve gate (T5).
+ *
+ * The pure functional core behind `serveMediaByHash`: the predicate that decides
+ * whether a media object's bytes may be served, and the content-type mapper for
+ * the (only) servable case. No I/O, no clock, no Prisma import — exhaustively
+ * unit/property-tested. The imperative shell (the route handler) maps the Prisma
+ * record to these inputs at the I/O boundary and never re-implements the
+ * decision inline.
+ */
+import type { ModerationStatus } from "./moderation-status.js";
+/**
+ * The ONLY state that may serve bytes.
+ *
+ * Flat and viewer-independent — there is **no owner exception**. The owner's
+ * optimistic "I can see my own upload" view is a client-local copy (Flutter),
+ * never a server URL. Operates on {@link ModerationStatus} (T1's hand-written
+ * source of truth), mapped from `MediaFile.moderationStatus` at the shell
+ * boundary.
+ *
+ * P0a invariant: video/audio are born `PENDING` and have no P0b worker to move
+ * them forward, so this predicate denies them for every viewer.
+ */
+export declare function canServe(status: ModerationStatus): boolean;
+/**
+ * The full serve decision for a looked-up media record. Returns `true` only when
+ * the object is `APPROVED` **and** not hidden **and** not soft-deleted. Every
+ * other combination (incl. a missing field) denies.
+ *
+ * The shell calls this with the fields read from the DB record; a `null` record
+ * (not-found) or a thrown query (DB-error) never reaches here — those deny via
+ * the uniform placeholder without consulting the predicate, so absence and
+ * not-yet-approved are byte-identical to a prober.
+ */
+export declare function isServable(record: {
+    moderationStatus: ModerationStatus;
+    hidden: boolean;
+    deletedAt: Date | null;
+}): boolean;
+/**
+ * Map the canonical re-encode format (T7's `env.media.canonicalFormat`) to the
+ * Content-Type emitted on an APPROVED response.
+ *
+ * Content-type is derived **only** from the canonical format the bytes were
+ * re-encoded into — never from `object.httpMetadata.contentType` (attacker-
+ * influenced) and never from the stored `mimeType`. In P0a only images reach
+ * APPROVED, so the canonical format is always one of the sharp-writable raster
+ * formats.
+ */
+export declare function canonicalContentType(canonicalFormat: "jpeg" | "png" | "webp"): string;
+//# sourceMappingURL=serve-gate.d.ts.map

package/dist/lib/media/serve-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-gate.d.ts","sourceRoot":"","sources":["../../../src/lib/media/serve-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GACvC,MAAM,CAYR"}

package/dist/lib/media/serve-gate.js

@@ -0,0 +1,68 @@
+/**
+ * Fail-closed serve gate (T5).
+ *
+ * The pure functional core behind `serveMediaByHash`: the predicate that decides
+ * whether a media object's bytes may be served, and the content-type mapper for
+ * the (only) servable case. No I/O, no clock, no Prisma import — exhaustively
+ * unit/property-tested. The imperative shell (the route handler) maps the Prisma
+ * record to these inputs at the I/O boundary and never re-implements the
+ * decision inline.
+ */
+/**
+ * The ONLY state that may serve bytes.
+ *
+ * Flat and viewer-independent — there is **no owner exception**. The owner's
+ * optimistic "I can see my own upload" view is a client-local copy (Flutter),
+ * never a server URL. Operates on {@link ModerationStatus} (T1's hand-written
+ * source of truth), mapped from `MediaFile.moderationStatus` at the shell
+ * boundary.
+ *
+ * P0a invariant: video/audio are born `PENDING` and have no P0b worker to move
+ * them forward, so this predicate denies them for every viewer.
+ */
+export function canServe(status) {
+    return status === "APPROVED";
+}
+/**
+ * The full serve decision for a looked-up media record. Returns `true` only when
+ * the object is `APPROVED` **and** not hidden **and** not soft-deleted. Every
+ * other combination (incl. a missing field) denies.
+ *
+ * The shell calls this with the fields read from the DB record; a `null` record
+ * (not-found) or a thrown query (DB-error) never reaches here — those deny via
+ * the uniform placeholder without consulting the predicate, so absence and
+ * not-yet-approved are byte-identical to a prober.
+ */
+export function isServable(record) {
+    if (record.hidden) {
+        return false;
+    }
+    if (record.deletedAt !== null && record.deletedAt !== undefined) {
+        return false;
+    }
+    return canServe(record.moderationStatus);
+}
+/**
+ * Map the canonical re-encode format (T7's `env.media.canonicalFormat`) to the
+ * Content-Type emitted on an APPROVED response.
+ *
+ * Content-type is derived **only** from the canonical format the bytes were
+ * re-encoded into — never from `object.httpMetadata.contentType` (attacker-
+ * influenced) and never from the stored `mimeType`. In P0a only images reach
+ * APPROVED, so the canonical format is always one of the sharp-writable raster
+ * formats.
+ */
+export function canonicalContentType(canonicalFormat) {
+    switch (canonicalFormat) {
+        case "jpeg":
+            return "image/jpeg";
+        case "png":
+            return "image/png";
+        case "webp":
+            return "image/webp";
+        default:
+            // Exhaustive in the type; defensive fallback keeps this total.
+            return "application/octet-stream";
+    }
+}
+//# sourceMappingURL=serve-gate.js.map

package/dist/lib/media/serve-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-gate.js","sourceRoot":"","sources":["../../../src/lib/media/serve-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAwB;IAC/C,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAI1B;IACC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAAwC;IAExC,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB;YACE,+DAA+D;YAC/D,OAAO,0BAA0B,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/lib/media/tenant-resolution.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure tenant-id resolution for the media path (T9).
+ *
+ * The media upload/serve shell must scope every CAS key by a tenant
+ * (`cas/{tenantId}/{hash}`, D18). The active tenant is normally ambient
+ * (`getCurrentTenantId()` from the auth seam, app.ts), but `TENANT_SCOPE_MODE`
+ * defaults to `"off"` and in that mode no ambient tenant is set on the request.
+ *
+ * ASSUMPTION (recorded per T9): when scope mode is `"off"` we fall back to the
+ * uploader's `User.personalTenantId`. This mirrors the graph layer's wiring
+ * (`input.tenantId ?? getCurrentTenantId()` in graph/postgres/sync.ts) — every
+ * user has a personal tenant created at sign-up (post-confirmation.ts), so the
+ * fallback is always available for an authenticated request. When scope mode is
+ * shadow/enforce the ambient tenant is authoritative and the fallback is not
+ * consulted (a missing ambient tenant in those modes is a real error, surfaced
+ * by the caller, not papered over by the personal tenant).
+ *
+ * This module is the PURE decision; the I/O (reading the ambient ALS value and
+ * loading `personalTenantId` from the DB) lives in the shell (media.ts).
+ */
+import type { TenantScopeMode } from "../tenant-scope.js";
+export type TenantResolution = {
+    ok: true;
+    tenantId: string;
+    source: "ambient" | "personal-fallback";
+} | {
+    ok: false;
+    reason: "no-tenant";
+};
+/**
+ * Decide which tenant id scopes a media object, given the ambient tenant (may
+ * be undefined), the uploader's personal tenant (may be undefined), and the
+ * deploy scope mode.
+ *
+ * - Ambient tenant always wins when present (any mode).
+ * - When scope mode is `"off"` and there is no ambient tenant, fall back to the
+ *   uploader's personal tenant.
+ * - In shadow/enforce with no ambient tenant, do NOT fall back — return
+ *   `no-tenant` so the caller fails closed.
+ */
+export declare function resolveMediaTenantId(ambientTenantId: string | undefined | null, personalTenantId: string | undefined | null, scopeMode: TenantScopeMode): TenantResolution;
+//# sourceMappingURL=tenant-resolution.d.ts.map

package/dist/lib/media/tenant-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-resolution.d.ts","sourceRoot":"","sources":["../../../src/lib/media/tenant-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAAA;CAAE,GACvE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC3C,SAAS,EAAE,eAAe,GACzB,gBAAgB,CAYlB"}

package/dist/lib/media/tenant-resolution.js

@@ -0,0 +1,45 @@
+/**
+ * Pure tenant-id resolution for the media path (T9).
+ *
+ * The media upload/serve shell must scope every CAS key by a tenant
+ * (`cas/{tenantId}/{hash}`, D18). The active tenant is normally ambient
+ * (`getCurrentTenantId()` from the auth seam, app.ts), but `TENANT_SCOPE_MODE`
+ * defaults to `"off"` and in that mode no ambient tenant is set on the request.
+ *
+ * ASSUMPTION (recorded per T9): when scope mode is `"off"` we fall back to the
+ * uploader's `User.personalTenantId`. This mirrors the graph layer's wiring
+ * (`input.tenantId ?? getCurrentTenantId()` in graph/postgres/sync.ts) — every
+ * user has a personal tenant created at sign-up (post-confirmation.ts), so the
+ * fallback is always available for an authenticated request. When scope mode is
+ * shadow/enforce the ambient tenant is authoritative and the fallback is not
+ * consulted (a missing ambient tenant in those modes is a real error, surfaced
+ * by the caller, not papered over by the personal tenant).
+ *
+ * This module is the PURE decision; the I/O (reading the ambient ALS value and
+ * loading `personalTenantId` from the DB) lives in the shell (media.ts).
+ */
+/**
+ * Decide which tenant id scopes a media object, given the ambient tenant (may
+ * be undefined), the uploader's personal tenant (may be undefined), and the
+ * deploy scope mode.
+ *
+ * - Ambient tenant always wins when present (any mode).
+ * - When scope mode is `"off"` and there is no ambient tenant, fall back to the
+ *   uploader's personal tenant.
+ * - In shadow/enforce with no ambient tenant, do NOT fall back — return
+ *   `no-tenant` so the caller fails closed.
+ */
+export function resolveMediaTenantId(ambientTenantId, personalTenantId, scopeMode) {
+    if (ambientTenantId) {
+        return { ok: true, tenantId: ambientTenantId, source: "ambient" };
+    }
+    if (scopeMode === "off" && personalTenantId) {
+        return {
+            ok: true,
+            tenantId: personalTenantId,
+            source: "personal-fallback",
+        };
+    }
+    return { ok: false, reason: "no-tenant" };
+}
+//# sourceMappingURL=tenant-resolution.js.map

package/dist/lib/media/tenant-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-resolution.js","sourceRoot":"","sources":["../../../src/lib/media/tenant-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA0C,EAC1C,gBAA2C,EAC3C,SAA0B;IAE1B,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,KAAK,KAAK,IAAI,gBAAgB,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,mBAAmB;SAC5B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC5C,CAAC"}

package/dist/lib/media/text-moderation.d.ts

@@ -0,0 +1,28 @@
+import type { ModerationVerdict } from "./moderation-provider.js";
+/**
+ * The text-moderation capability seam used by the AUDIO track (over a
+ * transcript) and by any caller needing to classify free text into the
+ * canonical 3-value verdict.
+ *
+ * Binding rule (same as MediaModerationProvider): absence of signal, an
+ * internal fault, a spent budget, or ANY uncertainty MUST fail closed to
+ * `decision: "review"`. An implementation must NEVER manufacture `approved`
+ * from doubt.
+ */
+export interface TextModerationProvider {
+    moderateText(text: string): Promise<ModerationVerdict>;
+}
+/**
+ * Test seam: returns a canned verdict (default fail-closed `review`). Labels, if
+ * programmed, must use ONLY opaque category tokens — never real-category strings.
+ */
+export declare class MockTextModerationProvider implements TextModerationProvider {
+    private verdict;
+    /** Records of each input, for assertions. */
+    readonly calls: string[];
+    constructor(canned?: ModerationVerdict);
+    /** Program the verdict returned by subsequent `moderateText` calls. */
+    setVerdict(verdict: ModerationVerdict): void;
+    moderateText(text: string): Promise<ModerationVerdict>;
+}
+//# sourceMappingURL=text-moderation.d.ts.map

package/dist/lib/media/text-moderation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-moderation.d.ts","sourceRoot":"","sources":["../../../src/lib/media/text-moderation.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxD;AAUD;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,OAAO,CAAC,OAAO,CAAoB;IAEnC,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;gBAElB,MAAM,GAAE,iBAAwC;IAI5D,uEAAuE;IACvE,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAItC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAI7D"}